Grim portents

Once you've established that a threat has an impending doom, and what it is, come up with 2-4 grim portents. These are milestones, steps along the way that will demonstrate the threat's progression. Grim portents should be concrete, observable things: things the PCs can see, or get word of, or feel the effects of. And—crucially grim portents should be something the PCs can react to and possibly prevent.

Just to be clear: grim portents are things that happen in the world around the PCs. They are NOT things that the PCs do. "Townsfolk form a cult" is a solid grim portent; "the PCs learn who the cultists are" is not. It presumes that the PCs care enough to investigate the cult, that they investigate, and that they succeed. That's not a grim portent—that's a railroad.

Similarly, a grim portent can be an event that involves the PCs, but it should never dictate an outcome. "The cultists attack the PCs in their homes" is great. You can safely assume the PCs will at some point be home, and who knows how the attack will play out? "The cultists capture the PCs" is not okay, because it assumes that cultists succeed at capturing them. Again, that's a railroad.